fix(core): remaining 15 sweep lows — client, clipboard, C ABI (v10), FEC, GSO, GTK

Second and final batch from the 2026-07-20 core-sweep lows:

client:
- connect() timeout now sets `quit` before shutdown, so a handshake that
  completes after the deadline closes with QUIT_CLOSE_CODE instead of
  leaving the host lingering (virtual display up) for a reconnect that
  never comes.
- probe_result: saturating_add on the wire-supplied wire_packets +
  send_dropped counters (debug-build overflow panic / release wrap).
- the standing-latency bleed no longer sets flush_in_window: that flag
  is the ABR's SEVERE (×0.7) verdict, and the bleed fires only on
  provably loss-free windows the controller itself scores as fine.

clipboard:
- fetch_cancels pruned on every new fetch (was: one dead oneshot per
  paste for the session).
- serve chunks gated on a parked waiter + capped at CLIP_FETCH_CAP with
  an Error event (was: unbounded silent accumulation under any req_id).
- serve_inbound park bounded by FETCH_STALL_SECS + send.stopped() (was:
  an unanswered FetchRequest parked the task, waiter, and bi-stream
  forever; ~100 of them exhaust the connection's bidi budget).

C ABI (ABI_VERSION 9 → 10, header regenerated, additive only):
- new punktfunk_connection_clock_offset_now_ns — the LIVE re-synced
  offset (Swift/Kotlin latency math read the frozen connect-time value
  ~40ms wrong after a wall-clock step).
- to_config: checked u64→usize narrowing of max_frame_bytes (32-bit
  armeabi truncated >4GiB to a plausible residue).
- host_poll_input: no &mut held across the embedder callback (re-entry
  aliased it — UB under noalias); mid-drain callback clears now stick.
- next_audio_pcm: DTX (empty) payloads skipped — decode synthesized
  120ms of concealment per 5ms slot and grew the playout ring forever.
- next_clipboard releases the parked payload on an empty poll (a one-off
  50MiB paste stayed resident all session).
- frames_dropped / wants_decode_latency write their documented 0/false
  defaults before the NULL-handle check.
- gamepad constant docs match pick_gamepad() reality (DualSenseEdge/
  SwitchPro landed; DualSense/DS4 honored on Windows UMDF too).

FEC:
- gf8 reconstruct/reconstruct_into reuse the (k,m) codec cache like
  encode_into (was: fresh 230×200 generator + decode inversion per
  lossy block on the pump thread).
- vendored fec-rs: the 8 safe wrap_mul_slice shims assert equal lengths
  (x86 SIMD callees bound stores on input.len() — safe-code OOB write);
  ReconstructShard's safety contract gains the len()==get().len()
  clause and reconstruct_internal sizes raw slices from the slice.

transport/GTK:
- Linux GSO super-buffer capped at the real UDP payload ceiling (65487)
  not 65535 — seg sizes ≥1024 could EMSGSIZE and latch GSO off
  process-wide, blamed on the network.
- GTK settings dialog no longer rewrites an unlisted-but-valid stored
  gamepad preference to "auto" on close.

Already fixed on main (verified stale, skipped): the reassembler FEC
ceiling, wants_decode_latency's third term, request_probe rollback +
the generalized probe watchdog.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

include/punktfunk_core.h

@@ -42,7 +42,10 @@
 // into apparent network latency). Struct-size change on the frame poll surface = a hard ABI
 // break for embedders reading `PunktfunkFrame`; nothing on the wire moved, so [`WIRE_VERSION`]
 // is unchanged.
-#define ABI_VERSION 9
+// v10: added `punktfunk_connection_clock_offset_now_ns` — the LIVE (mid-stream re-synced)
+// clock offset ongoing latency math must use; the connect-time getter stays frozen by
+// contract. Additive, client-local — no wire change, so [`WIRE_VERSION`] is unchanged.
+#define ABI_VERSION 10
 
 // The punktfunk/1 **wire** version — what `Hello`/`Welcome` carry and hosts equality-check.
 // Deliberately its own constant: [`ABI_VERSION`] tracks the embeddable **C surface**
@@ -110,8 +113,8 @@
 #define PUNKTFUNK_GAMEPAD_XBOX360 1
 
 // UHID DualSense (kernel `hid-playstation`): adaptive triggers, lightbar, touchpad, motion —
-// feedback arrives on the HID-output plane ([`punktfunk_connection_next_hidout`]). Honored
-// only where available (Linux hosts); otherwise the host falls back to X-Box 360.
+// feedback arrives on the HID-output plane ([`punktfunk_connection_next_hidout`]). Honored on
+// Linux (UHID) and Windows (UMDF minidriver) hosts; otherwise the host falls back to X-Box 360.
 #define PUNKTFUNK_GAMEPAD_DUALSENSE 2
 
 // uinput X-Box One / Series pad — the X-Box 360 backend with the One/Series USB identity, so
@@ -122,8 +125,8 @@
 
 // UHID DualShock 4 (kernel `hid-playstation` ≥ 6.2): lightbar, touchpad, motion, rumble — the
 // touchpad/motion arrive over the rich-input plane and lightbar over the HID-output plane, like
-// DualSense (minus adaptive triggers / player LEDs / mute). Honored only where available (Linux
-// hosts); otherwise the host falls back to X-Box 360.
+// DualSense (minus adaptive triggers / player LEDs / mute). Honored on Linux (UHID) and Windows
+// (UMDF minidriver) hosts; otherwise the host falls back to X-Box 360.
 #define PUNKTFUNK_GAMEPAD_DUALSHOCK4 4
 
 // UHID classic Steam Controller (Valve `28DE:1102`, kernel `hid-steam`): one stick + dual
@@ -136,11 +139,13 @@
 #define PUNKTFUNK_GAMEPAD_STEAMDECK 6
 
 // DualSense Edge (Sony `054C:0DF2`): the DualSense plus two back buttons + two Fn buttons, so a
-// client's back paddles land on native slots. Folds to `DUALSENSE` until its backend lands.
+// client's back paddles land on native slots. Honored on Linux (UHID `hid-playstation`) and
+// Windows (UMDF) hosts; otherwise the host falls back to X-Box 360.
 #define PUNKTFUNK_GAMEPAD_DUALSENSEEDGE 7
 
 // Nintendo Switch Pro Controller (Nintendo `057E:2009`, kernel `hid-nintendo`): Nintendo glyphs +
-// positional layout, gyro/accel, HD rumble. Folds to `XBOX360` until its backend lands.
+// positional layout, gyro/accel, HD rumble. Honored only where available (Linux hosts, UHID
+// `hid-nintendo`); otherwise the host falls back to X-Box 360.
 #define PUNKTFUNK_GAMEPAD_SWITCHPRO 8
 
 // New Steam Controller (2026, Valve `28DE:1302`) passed through AS-IS: the host mirrors the
@@ -2215,6 +2220,20 @@ PunktfunkStatus punktfunk_connection_clock_offset_ns(const PunktfunkConnection *
                                                      int64_t *offset_ns);
 #endif
 
+#if defined(PUNKTFUNK_FEATURE_QUIC)
+// The **live** host↔client wall-clock offset (nanoseconds, host minus client): the
+// connect-time estimate of [`punktfunk_connection_clock_offset_ns`], updated by every applied
+// mid-stream clock re-sync. Ongoing latency math (per-frame `received − pts` splits, the
+// glass-to-glass meter) must use this one — after a wall-clock step/slew the frozen
+// connect-time value reads tens of milliseconds wrong for the rest of the session, while the
+// core itself has already re-synced. Same clock contract as the connect-time getter.
+//
+// # Safety
+// `c` is a valid connection handle; `offset_ns` is writable (NULL is skipped).
+PunktfunkStatus punktfunk_connection_clock_offset_now_ns(const PunktfunkConnection *c,
+                                                         int64_t *offset_ns);
+#endif
+
 #if defined(PUNKTFUNK_FEATURE_QUIC)
 // Ask the host to switch the live session to `width`x`height`@`refresh_hz` without
 // reconnecting (window resized, refresh changed). Non-blocking enqueue: on acceptance the